On Sun, Sep 05, 2021 at 02:31:06PM +0800, 杨男子 wrote: > Hi, our team has found a problem in fs system on Linux kernel v5.10, leading to DoS attacks. > > The pseudo-terminals can be opened by normal user can be exhausted by one singal normal user by calling syscall such as open. A normal user keeps opening/dev/ptmx to trigger ptmx_open, which calls devpts_new_index and increases pty_count. In a couple of seconds, the pty_count limit is reached, and other normal user’s ptmx_open operations fail. > > In fact, we try this attack inside a deprivileged docker container without any capabilities. The processes in the docker can exhaust all normal user’s pseudo-terminals on the host kernel. We use a machine with 16G memory. We start 4 processes to open /dev/ptmx repeatedly. In total, around 3072 number of pseudo-terminals are consumed and other normal user can not use pseudo-terminals. If you are concerned about this, please restrict the kernel.pty.max value to be much lower. Otherwise, do not run untrusted code in a container and expect it to not be able to use up system resources :) All of these "reports" you sent out today, seem to imply that you feel that containers should never be allowed to take up resources from things in other containers or elsewhere on the system. As has been pointed out, that is possible, but you need to tune your system to keep that from happening by using one of the many various resource limit "knobs" that are available to you. These are not kernel bugs, but rather system configuration issues in userspace from what I can determine. thanks, greg k-h
